Google GTIG tracks shift to industrial-scale adversary use of AI for vulnerability exploitation and initial access

Google Threat Intelligence Group's May 11 AI Threat Tracker, building on its February 2026 report and drawing on Mandiant incident-response engagements, Gemini insights and proactive research, describes a maturing transition from nascent AI-enabled operations to industrial-scale application of generative models inside adversarial workflows. Per GTIG, the current environment is dual-natured: AI serves as both a sophisticated engine for adversary operations and a high-value target for attacks. The report says GTIG has for the first time identified activity in AI-driven vulnerability discovery and exploit generation, though the feed text truncates before the specifics.